CVE-2026-7113 Details
Description
A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of the component Webhooks Endpoint. The manipulation of the argument _INSECURE_NO_AUTH results in missing authentication. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.
A critical vulnerability allowing unauthenticated remote code execution has been identified in NousResearch hermes-agent version 0.8.0. The issue arises in the webhooks endpoint, specifically within the file gateway/platforms/webhook.py. The vulnerability is triggered by setting the webhook route's secret to 'INSECURE_NO_AUTH', which disables HMAC signature verification. This allows any network client to send POST requests to the webhook without authentication, with the payload being executed as a command by the agent.
The latest version of hermes-agent includes a fix for this vulnerability. Users should update to version 0.11.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NousResearch/hermes-agent/ | [email protected] | Source CodeVendor |
| https://github.com/NousResearch/hermes-agent/issues/6440 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/NousResearch/hermes-agent/pull/6445 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/submit/800802 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359713 | [email protected] | AdvisoryExploit |
| https://vuldb.com/vuln/359713/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NousResearch hermes-agent | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |